6 ms·

FB also considers "won't fix" a bug I found a while ago that allows anyone to send anyone else on FB a spoofed email that comes from @facebook.com, without know

by mpeg 10y ago

FB also considers "won't fix" a bug I found a while ago that allows anyone to send anyone else on FB a spoofed email that comes from @facebook.com, without knowing their email address ¯\_(ツ)_/¯.

tomglynch 10y ago
That's pretty severe surely. Any more information?
- mpeg 10y ago
  Not sure I'm comfortable with full disclosure as I still consider it potentially harmful (phishing mostly, or sending unsolicited emails without knowing the fb login email of a user) Maybe I should try to report it again on Hackerone, as this was reported through the old whitehat program and the guy who answered never fully addressed the issue or replied to my follow up
  - s_q_b 10y ago
    Sunlight it, if they won't change it. Bad publicity and bad behavior from other actors will only increase the likelihood that the bug gets fixed. If a company won't listen you've done your moral duty. The last step of responsible disclosure is publication. As a bonus, you'll probably even frontpage HN.
    - _lce0 10y ago
      Agree. Plus he has given lot of pointers so it's a matter of time someone find the comment and start trial-and-error to discover how to exploit the bug.
- moron4hire 10y ago
  This is a well-known issue with email. The "From" address is not validated. This is all email providers and all email clients.
JohnTHaller 10y ago
Can't you just send someone an email to their facebookid@facebook.com since most people have a facebook email address and don't know about it? And then just use a fake from address of whatever@facebook.com?
- mpeg 10y ago
  This sends the email to the login email address, not to the @facebook.com address, you could fake the email headers but that'd get caught by most webmail filters as a spoof. I think theoretically the @facebook.com email address is now supposed to redirect to primary email too, even though that doesn't really work for me (bounces back)
extra88 10y ago
I'm not following how that's different than any other platform that receives email, From: addresses aren't verified. I can send you a message From: lpage@google.com to your gmail address, what difference does it make if I can send a message from any @facebook.com address, real or imagined, to you at your @facebook.com address?
- mpeg 10y ago
  Ok, if I send you an email from facebookadminforsure@gmail.com with a link saying "Your Facebook account has been compromised" that takes to a phising page, you probably won't click. If I try to spoof my email to make it look like I'm sending it from @facebook.com, your webmail provider will tell you this email might be fraudulent (and likely place it straight in the spam folder) With this method, you get a legit email from @facebook.com, but I can edit the content of the email to point to a url under my control
  - extra88 10y ago
    > If I try to spoof my email to make it look like I'm sending it from @facebook.com, your webmail provider will tell you this email might be fraudulent (and likely place it straight in the spam folder) I'm looking at the headers of an automated message sent by Facebook (so-and-so shared a post), received by Gmail: Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) XXX@facebookmail.com; spf=fail (google.com: domain of XXX@facebookmail.com does not designate ### as permitted sender) This suggests to me DKIM and SPF are not weighted heavily to determine the legitimacy of a message from Facebook (or "Facebook") and filtering would be based more on the body of the message, as it often is, including the URL you specify. I don't see how Facebook email is less secure than email in general, email in general is not secure.
    - mpeg 10y ago
      This is a special case which passes dkim, spf and dmarc.

by mpeg 10y ago

FB also considers "won't fix" a bug I found a while ago that allows anyone to send anyone else on FB a spoofed email that comes from @facebook.com, without knowing their email address ¯\_(ツ)_/¯.

tomglynch 10y ago

That's pretty severe surely. Any more information?

mpeg 10y ago
Not sure I'm comfortable with full disclosure as I still consider it potentially harmful (phishing mostly, or sending unsolicited emails without knowing the fb login email of a user) Maybe I should try to report it again on Hackerone, as this was reported through the old whitehat program and the guy who answered never fully addressed the issue or replied to my follow up
- s_q_b 10y ago
  Sunlight it, if they won't change it. Bad publicity and bad behavior from other actors will only increase the likelihood that the bug gets fixed. If a company won't listen you've done your moral duty. The last step of responsible disclosure is publication. As a bonus, you'll probably even frontpage HN.
  - _lce0 10y ago
    Agree. Plus he has given lot of pointers so it's a matter of time someone find the comment and start trial-and-error to discover how to exploit the bug.
moron4hire 10y ago
This is a well-known issue with email. The "From" address is not validated. This is all email providers and all email clients.

JohnTHaller 10y ago

Can't you just send someone an email to their facebookid@facebook.com since most people have a facebook email address and don't know about it? And then just use a fake from address of whatever@facebook.com?

mpeg 10y ago
This sends the email to the login email address, not to the @facebook.com address, you could fake the email headers but that'd get caught by most webmail filters as a spoof. I think theoretically the @facebook.com email address is now supposed to redirect to primary email too, even though that doesn't really work for me (bounces back)

extra88 10y ago

I'm not following how that's different than any other platform that receives email, From: addresses aren't verified. I can send you a message From: lpage@google.com to your gmail address, what difference does it make if I can send a message from any @facebook.com address, real or imagined, to you at your @facebook.com address?

mpeg 10y ago
Ok, if I send you an email from facebookadminforsure@gmail.com with a link saying "Your Facebook account has been compromised" that takes to a phising page, you probably won't click. If I try to spoof my email to make it look like I'm sending it from @facebook.com, your webmail provider will tell you this email might be fraudulent (and likely place it straight in the spam folder) With this method, you get a legit email from @facebook.com, but I can edit the content of the email to point to a url under my control
- extra88 10y ago
  > If I try to spoof my email to make it look like I'm sending it from @facebook.com, your webmail provider will tell you this email might be fraudulent (and likely place it straight in the spam folder) I'm looking at the headers of an automated message sent by Facebook (so-and-so shared a post), received by Gmail: Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) XXX@facebookmail.com; spf=fail (google.com: domain of XXX@facebookmail.com does not designate ### as permitted sender) This suggests to me DKIM and SPF are not weighted heavily to determine the legitimacy of a message from Facebook (or "Facebook") and filtering would be based more on the body of the message, as it often is, including the URL you specify. I don't see how Facebook email is less secure than email in general, email in general is not secure.
  - mpeg 10y ago
    This is a special case which passes dkim, spf and dmarc.